bag_pack()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Creates a dynamic property bag object from a list of keys and values.

Deprecated aliases: pack(), pack_dictionary()

Syntax

bag_pack(key1, value1, key2, value2,... )

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
key	string	✔️	The key name.
value	any scalar data type	✔️	The key value.

Returns

Returns a dynamic property bag object from the listed key and value inputs.

Examples

Example 1

The following example creates and returns a property bag from an alternating list of keys and values.

print bag_pack("Level", "Information", "ProcessID", 1234, "Data", bag_pack("url", "www.bing.com"))

Results

print_0
{"Level":"Information","ProcessID":1234,"Data":{"url":"www.bing.com"}}

Example 2

The following example creates a property bag and extract value from property bag using '.' operator.

datatable (
    Source: int,
    Destination: int,
    Message: string
) [
    1234, 100, "AA", 
    4567, 200, "BB",
    1212, 300, "CC" 
]
| extend MyBag=bag_pack("Dest", Destination, "Mesg", Message)
| project-away Source, Destination, Message
| extend MyBag_Dest=MyBag.Dest, MyBag_Mesg=MyBag.Mesg

Results

MyBag	MyBag_Dest	MyBag_Mesg
{"Dest":100,"Mesg":"AA"}	100	AA
{"Dest":200,"Mesg":"BB"}	200	BB
{"Dest":300,"Mesg":"CC"}	300	CC

Example 3

The following example uses two tables, SmsMessages and MmsMessages, and returns their common columns and a property bag from the other columns. The tables are created ad-hoc as part of the query.

SmsMessages

SourceNumber	TargetNumber	CharsCount
555-555-1234	555-555-1212	46
555-555-1234	555-555-1213	50
555-555-1212	555-555-1234	32

MmsMessages

SourceNumber	TargetNumber	AttachmentSize	AttachmentType	AttachmentName
555-555-1212	555-555-1213	200	jpeg	Pic1
555-555-1234	555-555-1212	250	jpeg	Pic2
555-555-1234	555-555-1213	300	png	Pic3

let SmsMessages = datatable (
    SourceNumber: string,
    TargetNumber: string,
    CharsCount: string
) [
    "555-555-1234", "555-555-1212", "46", 
    "555-555-1234", "555-555-1213", "50",
    "555-555-1212", "555-555-1234", "32" 
];
let MmsMessages = datatable (
    SourceNumber: string,
    TargetNumber: string,
    AttachmentSize: string,
    AttachmentType: string,
    AttachmentName: string
) [
    "555-555-1212", "555-555-1213", "200", "jpeg", "Pic1",
    "555-555-1234", "555-555-1212", "250", "jpeg", "Pic2",
    "555-555-1234", "555-555-1213", "300", "png", "Pic3"
];
SmsMessages 
| join kind=inner MmsMessages on SourceNumber
| extend Packed=bag_pack("CharsCount", CharsCount, "AttachmentSize", AttachmentSize, "AttachmentType", AttachmentType, "AttachmentName", AttachmentName) 
| where SourceNumber == "555-555-1234"
| project SourceNumber, TargetNumber, Packed

Results

SourceNumber	TargetNumber	Packed
555-555-1234	555-555-1213	{"CharsCount":"50","AttachmentSize":"250","AttachmentType":"jpeg","AttachmentName":"Pic2"}
555-555-1234	555-555-1212	{"CharsCount":"46","AttachmentSize":"250","AttachmentType":"jpeg","AttachmentName":"Pic2"}
555-555-1234	555-555-1213	{"CharsCount":"50","AttachmentSize":"300","AttachmentType":"png","AttachmentName":"Pic3"}
555-555-1234	555-555-1212	{"CharsCount":"46","AttachmentSize":"300","AttachmentType":"png","AttachmentName":"Pic3"}